Leonardo Devai
f17d20ff48
Pinned 2026 toolchains (Go 1.26, Rust 1.98/edition 2024, Python 3.14 + uv, Node 24, Zig 0.16, NixOS 26.05), postgres 18 / mongo 8, lockfiles built from, non-root runtimes, .dockerignore, per-project LICENSE, READMEs with the git.devai.io clone line, checkout@v7 CI. Security fixes in the legacy Rust APIs (any-password login, self-assigned admin, hard-coded JWT secret), JWT alg/exp/sub enforcement across the blog series, safe markdown links in the frontends, and many smaller bugs — every project was built, run and exercised end to end. Adds scripts/publish.sh + a CI publish job that splits every folder into its own repo at git.devai.io/templates/<folder>. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01128fhuZbgivaSJvtMf4s1G
16 lines
544 B
Docker
16 lines
544 B
Docker
FROM python:3.14-slim AS build
|
|
COPY --from=ghcr.io/astral-sh/uv:latest /uv /bin/uv
|
|
ENV UV_PROJECT_ENVIRONMENT=/venv UV_COMPILE_BYTECODE=1 UV_LINK_MODE=copy UV_PYTHON_DOWNLOADS=never
|
|
WORKDIR /src
|
|
COPY pyproject.toml uv.lock ./
|
|
RUN uv sync --locked --no-dev --no-install-project
|
|
|
|
FROM python:3.14-slim
|
|
RUN useradd --system --uid 10001 app
|
|
WORKDIR /srv
|
|
COPY --from=build /venv /venv
|
|
COPY app ./app
|
|
ENV PATH="/venv/bin:$PATH" PYTHONUNBUFFERED=1
|
|
USER app
|
|
EXPOSE 8080
|
|
CMD ["sh", "-c", "exec uvicorn app.main:app --host 0.0.0.0 --port ${PORT:-8080}"]
|